Canada's Securities Regulators Report On Cybersecurity Disclosure Review

Canada's securities regulators have conducted a wide-ranging review of the largest Canadian publicly listed companies' practices regarding the disclosure of cybersecurity risks and incidents (Review). The Review, and accompanying report (Report), were recently published in a staff notice of the Canadian Securities Administrators (CSA), the informal coalition of Canada's provincial and territorial securities regulators. Ross McKee and Kristin Ali of Blake, Cassels & Graydon LLP, discuss the Review's consideration of how cybersecurity issues have been, and should be, addressed in the context of risk factor disclosure.

BACKGROUND

The CSA has been pressing to raise awareness on cybersecurity issues since 2013, when it published its first Staff Notice on the topic, 11-326 Cyber Security. That notice was a "shot across the bow" for registrants, such as dealers and advisers, other regulated entities, such as marketplaces and clearing agencies, and reporting issuers.